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Response to Arguments 

Applicant's arguments filed January 13, 2006 have been fully considered 
but they are not persuasive. Per the amended claims limitations, "wherein a 
connection is established between the terminal and the ISP for trusted network 
services without providing the terminal with direct access to the internet", Giniter 
discloses per Col 9 lines 30-56 "An Internet Point-of-Presence (POP) 220 
provides an access point for communication between edge device 110 and 
Internet 100" and this reads on the claim limitations in that the access to the 
internet goes to the Internet Point-of-Presence (POP) 220, and in that sense it is 
not have direct access. 

Claim Objections 

Claim 32 objected to because of the following informalities: Claim 32 
depends on itself. Appropriate correction is required. 



Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this 
Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for patent or 
(2) a patent granted on an application for patent by another filed in the United States before 
the invention by the applicant for patent, except that an international application filed under 
the treaty defined in section 351(a) shall have the effects for purposes of this subsection of an 
application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 
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Claim 1-22, 24-25, 28, 30, 33 and 35-37, and 39-41 are rejected under 35 
U.S.C. 102(e) as being anticipated by Ginigeret al. (US 6,751,729). 

As per claim 1 , Giniger et al. discloses a method for performing mutual 
authentication and authorization of a user's terminal device (U) and an Internet 
Service Provider (P) (Col 1 1 lines 55-58) in order to establish secure 
communication between the terminal (U) and a trusted network element (T) to 
the Internet via an untrusted access station (A) comprising: 

establishing an association between a terminal (U) and an untrusted 
access station (A); (Col 9 lines 30-35) 

transmitting an ISP authentication packet from terminal (U) to ISP (P) via 
the untrusted access station (A); (Col 14 lines 47-50) 

sending a user authentication packet from said ISP (P) to said terminal (U) 
via said untrusted access station (A); (Col 8 lines 36-41) 

upon authentication of said terminal (U) and said ISP (P), said ISP 
performs the following: generating a session key; (Col 15 line 19) 

distributing said session key to said terminal (U) and a trusted network 
element (T), wherein said session key is used to encrypt traffic between the 
terminal (U) and the trusted network element (T); (Col 15 lines 19-22) 

establishing a secure tunnel such that the terminal (U) may communicate 
with the Internet via said trusted network element (T); wherein said secure tunnel 
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emulates a physical link between the terminal (U) and the trusted network 
element (T) (Col 1 1 lines 55-58) such that traffic transmitted between the terminal 
(U) and said Internet via said trusted network element (T) is secure from 
modification or eavesdropping by said third party access station (A). (Col 12 
lines 14-22, Col 6 lines 14-22) 

wherein a connection is established between the terminal the ISP for 
trusted network services without providing the terminal with direct access to the 
internet. (Col 9 lines 30-56 "An Internet Point-of-Presence (POP) 220 provides 
an access point for communication between edge device 110 and Internet 100" 
and this reads on the claim limitations in that the access to the internet goes to 
the Internet Point-of-Presence (POP) 220, and in that sense it is not have direct 
access.,) 

As per claim 2, Giniger et al. discloses the method for performing mutual 
authentication and authorization of a terminal (U) and an Internet Service 
Provider (P) in order to establish a secure tunnel between the terminal (U) and a 
trusted network element to the Internet (T) via an untrusted access station (A) of 
claim 1, wherein the ISP (P) authentication packet contains an authentication 
challenge (CH_U) from terminal (U) to ISP (P) to authenticate the identity of ISP 
(P). (Col 5 lines 62-65, Col 12 lines 15-17, Col 12 lines 25-27, Col 14 lines 57-62) 

As per claim 3, Giniger et al. discloses the method for performing mutual 
authentication and authorization of a terminal (U) and an Internet Service 



Application/Control Number: 10/057,914 Page 5 

Art Unit: 2141 

Provider (P) in order to establish a secure tunnel between the terminal (U) and a 
trusted network element to the Internet (T) via an untrusted access station (A) of 
claim 1 , wherein the user authentication packet contains an authentication 
challenge (CH_P) from ISP (P) to the terminal (U) to authenticate the identity of 
user (U). (Col 5 lines 58-67, Col 12 lines 25-27, Col 14 lines 52-57) 

As per claim 4, Giniger et al. discloses a method for providing public 
access to IP-based networks via an untrusted infrastructure having untrusted 
access points comprising: 

establishing a connection between an IP-device (U) and said untrusted 
access point (A), (Col 9 lines 30-35, Figure 2 item 220) wherein an IP address is 
dynamically allocated to said IP device; (Col 11 lines 59-63) 

transmitting an ISP authentication request from said IP device (U) to an 
internet service provider (P) affiliated with said IP device (U), (Col 14 lines 47-50) 
wherein said authentication request is transmitted through said untrusted access 
point (A) affiliated with said untrusted third party owned infrastructure; (Col 9 
lines 30-35, Figure 2 item 200) 

transmitting a user authentication request from said ISP (P) to said IP 
device (U) to determine whether said IP device (U) is a valid user affiliated with 
said ISP (P), (Col 8 lines 36-41) wherein said authentication request is 
transmitted through said untrusted access point (A) affiliated with said untrusted 
third party owned infrastructure; (Col 9 lines 30-35, Figure 2 item 200) 
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when said ISP (P) authentication request and said user authentication 
requests is affirmative, (Col 14 lines 54-67) said ISP (P): generates a key session 
for encrypting data packets; and distributes said session key to said IP device 
(U) and a trusted node (T), wherein said session key is used to encrypt data 
transmitted between said IP device (U) and said trusted node (T); (Col 15 lines 
19-22) 

establishing a secure tunnel (Col 1 1 lines 55-58) as said session key is 
used to encrypt data packets transmitted between said IP device (U) and said 
trusted node (T), such that said data packets transmitted between said IP device 
(U) and an Internet via the untrusted access station (A) are protected from 
modification and manipulation by said untrusted access station (A) in said secure 
tunnel. (Col 12 lines 14-22, Col 6 lines 14-22) 

As per claims 5, 6 and 35, Giniger et al. discloses a method for providing 
public access to IP-based networks through a third party owned, untrusted 
infrastructure having untrusted access stations (A) comprising: 

establishing a connection between an IP-device (U) and said access 
station (A), (Col 9 lines 30-35) wherein an IP address is dynamically allocated to 
said IP device (U); (Col 1 1 lines 59-63) sending an ISP authentication request to 
said internet service provider (P) affiliated with said IP device (U) requesting to 
validate the authenticity of the ISP (P); (Col 14 lines 47-50, Col 14 lines 57-62) 

sending a user authentication request from said ISP (P) to said IP device 
(U) to validate whether said IP device (U) has a service agreement with said ISP 
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(P); (Col 14 lines 47-54) upon affirmative authentication of said ISP (P) and said 
IP device (U); (Col 14 lines 54-57) 

establishing a trusted connection between said IP device (U) and a trusted 
network element (T), (Col 1 1 lines 55-58) wherein a secure tunnel allows the ISP 
(P) to dynamically obtain control of resource in (Col 16 lines 41-46) said 
untrusted third party owned access station (A) (Col 9 lines 30-35, Figure 2 item 
200) in order to provide the IP device (U) with prescribed for services. (Col 10 
lines 9-20) 

wherein a connection is established between the terminal the ISP for 
trusted network services without providing the terminal with direct access to the 
internet. (Col 9 lines 30-56 "An Internet Point-of-Presence (POP) 220 provides 
an access point for communication between edge device 110 and Internet 100" 
and this reads on the claim limitations in that the access to the internet goes to 
the Internet Point-of-Presence (POP) 220, and in that sense it is not have direct 
access .) 

As per claim 7, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 6, 
wherein the ISP authentication request contains an authentication challenge 
(CH_U) from terminal (U) to ISP (P) to authenticate the identity of ISP (P). (Col 5 
lines 62-65, Col 12 lines 15-17, Col 12 lines 25-27, Col 14 lines 57-62) 
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As per claim 8, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 6, 
wherein the user authentication request contains an authentication challenge 
(CHJP) from ISP (P) to the terminal (U) to authenticate the identity of terminal 
(U) as having subscribed to said ISP (P) for services. (Col 5 lines 58-67, Col 12 
lines 25-27, Col 14 lines 52-57) 

As per claim 9, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 6, 
the ISP (P) generates a session key for encrypting data packets upon the 
affirmative authentication of the terminal (U) and the ISP (P). (Col 14 lines 54- 
67, Col 15 line 19-22) 

As per claim 10, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 6, 
wherein the ISP (P) selects a trusted node (T) with said Internet. (Col 16 lines 42- 
45, Col 17 lines 24-28) 

As per claim 1 1 , Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
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with that terminal and the Internet over an untrusted access station (A) of claim 9, 
wherein said ISP (P) distributes said session key to the terminal (U) and the 
trusted node (T). (Col 15 lines 19-22) 

As per claim 12, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 6, 
wherein the session key is used to encrypt data packets transmitted between the 
terminal (U) and the trusted node (T). (Col 15 lines 19-22) 

As per claim 13, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 

12, wherein the transmission of encrypted data packets between the terminal (U) 
and the trusted node (T) established a secure tunnel. (Col 1 1 lines 55-58) 

As per claim 14, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 

13, wherein the secure tunnel protects the data packets from manipulation by 
said untrusted access station (A). (Col 12 lines 14-22, Col 6 lines 14-22) 
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As per claim 15, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 6, 
a time out is distributed to the trusted node (T) and terminal (U) upon the 
establishment of a secure tunnel. (Col 6 lines 23-27, Col 17 lines 28-34) 

As per claim 16, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 
1 5, wherein the timeout value is set to a predetermined time period, wherein if 
the secure tunnel is active for a time period equal to the timeout value, the 
secure tunnel will expire and the resources utilized for the secure tunnel will be 
releases. (Col 6 lines 23-27, Col 17 lines 28-34) 

As per claim 17, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 6, 
wherein upon receipt of an encrypted data packet from the terminal (U), the 
trusted node (T) decrypts the data packet and forwards the decrypted data 
packet to the Internet. (Col 7 lines 45-48, Col 12 lines 19-22, Col 15 lines 19-22, 
Col 17 lines 44-47) 



Application/Control Number: 10/057,914 Page 11 

Art Unit: 2141 

As per claim 18, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 

17, wherein upon receipt of an encrypted data packet from the terminal (U), the 
trusted node (T) decrypts the data packet and forwards the decrypted data 
packet to a remote communication peer (R). (Col 12 lines 19-22, Col 15 lines 19- 
22, Col 17 lines 44-47) 

As per claim 19, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 

18, wherein the Internet sends an original data packet to the terminal (U) via the 
trusted node (T), wherein the trusted node (T) encrypts the original data packet 
and forwards the encrypted data packet to the terminal (U) via the untrusted 
access station (A). (Col 9 lines 30-35, Col 12 lines 19-22, Col 15 lines 19-22, Col 
17 lines 44-47) 

As per claim 20, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 
17, wherein upon receipt of the encrypted data packet from the trusted node (T), 
the terminal (U) utilizes the session key to decrypt the data packet thus yielding 
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the original data packet from the Internet. 
47, Col 17 lines 44-47) 



Page 

(Col 13 lines 54-59, Col 15 lines 44- 



As per claim 21 , Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 
18, wherein a remote communication peer (R) sends an original data packet to 
the terminal (U) via the trusted node (T), wherein the trusted node (T) encrypts 
the original data packet and forwards the encrypted data packet to the terminal 
(U) via the untrusted access station (A). (Col 9 lines 30-35, Col 12 lines 9-12, 
Col 15 lines 9-12, Col 17 lines 44-47) 

As per claim 22, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 
21, wherein upon receipt of the encrypted data packet from the trusted node (T), 
the terminal (U) utilizes the session key to decrypt the data packet thus yielding 
the original data packet from the remote communication peer (R). (Col 13 lines 
54-59, Col 15 lines 44-47, Col 17 lines 44-47) 

As per claim 24, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 6, 
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wherein the untrusted access station (A) is incorporated into a third party owned 
network infrastructure. (Col 9 lines 30-32) 

As per claim 25, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 
24, wherein the ISP (P) provides the terminal (U) with at least one subscribed for 
service via an untrusted access station (A). (Col 10 lines 9-20) 

As per claim 28, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 
24, wherein the untrusted access station (A) is located in the network 
infrastructure of a public facility. (Col 6 lines 14-16, Col 10 lines 9-20) 

As per claim 30, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 
24, wherein the untrusted access station (A) is located within the infrastructure of 
a private household or within the private infrastructure of a corporation or 
government institution. (Col 6 lines 44-46, Col 10 lines 9-20) 



Application/Control Number: 10/057,914 Page 
Art Unit: 2141 

As per claim 33, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated 
with that terminal and the Internet over an untrusted access station (A) of claim 6, 
wherein the terminal (U) recognizes a compatible access point by broadcasting a 
dynamic host configuration protocol (DHCP) request and receiving a "magic" 
DHCP response from the untrusted access station (A). (Col 9 lines 5-1 1 , Col 1 1 
lines 36-51, Col 11 lines 59-67, Col 12 lines 1-2) 

As per claim 36, Giniter et al. discloses a method of operating an 
untrusted access station deployed so as to provide a local network with access to 
a wide area network, the method comprising: 

an untrusted access station receiving a request from a terminal to access 
trusted network services; (Col 9 lines 30-35) 

without providing the terminal with direct access to the wide area network, 
establishing a connection between the terminal and an authentication 
server for trusted network services (Col 9 lines 30-56 "An Internet Point-of- 
Presence (POP) 220 provides an access point for communication between edge 
device 110 and Internet 100" and this reads on the claim limitations in that the 
access to the internet goes to the Internet Point-of-Presence (POP) 220, and in 
that sense it is not have direct access.j 

performing authentication of the terminal with the authentication server for 
the trusted network services; (Col 15 line 19) 
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allowing the terminal to establish a secure channel to trusted network 
services across the wide area network only if the authentication succeeds. (Col 
6 lines 14-22, Col 12 lines 14-22) 

As per claim 37, Giniter et al. discloses the method of claim 36 wherein 
the authentication is performed using messages protected by public key 
cryptography. (Col 5 lines 30-44) 

As per claim 39, Giniter et al. discloses the method of claim 36 wherein 
the networks are Internet Protocol networks. (Col 7 lines 33-52) 

As per claim 40, Giniter et al. discloses the method of claim 39 wherein 
the untrusted access station does not assign a global IP address to the terminal 
but allows the terminal to receive an IP address from the trusted network 
services. (Col 10 lines 31-56) 

As per claim 41 , Giniter et al. discloses the method of claim 39 wherein 
the access station assigns the terminal a special IP address acknowledging that 
it is able to provide access to the trusted network services. (Col 10 lines 31-56) 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 
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(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 102 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

Claims 23, 26-27, 29, 31-32, 34 and 38 are rejected under 35 U.S.C. 
1 03(a) as being unpatentable over Giniger et al. (US 6,751 ,729) in view of Rueda 
et al. (US2002/01 12076). 

As per claim 23, Giniger et al. discloses a method of claim 6, however, 
fails to disclose providing an accounting of time to the untrusted access station 
(A) for resources utilized by the terminal (U). Rueda et al. discloses wherein the 
ISP (P) provides an accounting of time to the untrusted access station (A) for 
resources utilized by the terminal (U). ([0202]) It would have been obvious to a 
person of ordinary skill in the art at the time the invention to provide an 
accounting of time to the untrusted access station (A) for resources utilized by 
the terminal (U) in the disclosure of Giniger et al. because it allows for proprietors 
of the system to bill for usage. ([01 88]) 

As per claim 26, Giniger et al. discloses a method of claim 6, however, 
fails to disclose that the ISP (P) reimburses the untrusted access station (A) for 
resources expended on the terminal (U) according to an accounting of time. 
Rueda et al. discloses wherein the ISP (P) reimburses the untrusted access 
station (A) for resources expended on the terminal (U) according to an 
accounting of time. ([0189], [0202]). It would have been obvious to a person of 
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ordinary skill in the art at the time the invention for the ISP (P) to reimburse the 
untrusted access station (A) for resources expended on the terminal (U) 
according to an accounting of time in the disclosure of Giniger et al. because it is 
an excellent opportunity for advertisement and provide branding, services, and 
advertising messages to users. ([0189]) 

As per claims 27 and 38, Giniger et al. discloses a method of claim 25, 
however, fails to disclose the ISP (P) bills the terminal (U) for services provided 
to the terminal (U). Rueda et al. discloses wherein the ISP (P) bills the terminal 
(U) for services provided to the terminal (U). ([0188]) It would have been 
obvious to a person of ordinary skill in the art at the time the invention for the ISP 
(P) to bill the terminal (U) for services provided to the terminal (U) in the 
disclosure of Giniger et al. because it allows to charge costs incurred by the 
visiting client for system services. ([0200]) 

As per claim 29, Giniger et al. discloses a method of claim 28, however, 

fails to 

disclose the public facility is at least one of an airport, a convention center, a 
restaurant, a hotel, a library, and a school. Rueda et al. discloses wherein the 
public facility is at least one of an airport, a convention center, a restaurant, a 
hotel, a library, and a school. ([0063],[0153]) It would have been obvious to a 
person of ordinary skill in the art at the time the invention for a public facility to be 
an airport, a convention center, a restaurant, a hotel, a library, and a school in 
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the disclosure of Giniger et al. because it allows travelers would be able to have 
high-speed Internet access from within their suites with their computers that have 
been configured for their individual corporate LANs or home use. ([0063]). 

As per claim 31, Giniger et al. discloses a method of claim 6, however, 
fails to disclose the untrusted access stations (A) is compatible with at least one 
wireless transmission. Rueda et al. discloses wherein the untrusted access 
stations (A) is compatible with at least one wireless transmission standard 
including WLAN (IEEE 802.11), BlueTooth (IEEE 802.15), or HiperLan. 
([0267], [0268]) It would have been obvious to a person of ordinary skill in the art 
at the time the invention for the untrusted access stations (A) to be compatible 
with at least one wireless transmission because it provides laptop access using 
wireless Ian cards. ([0268]) 

As per claim 32, Giniger et al. discloses a method of claim 6, however fails 
to disclosure the terminal (U) is a mobile device. Rueda et al. discloses wherein 
the terminal (U) is a mobile device. ([0063], [0207], [0274]) It would have been 
obvious to a person of ordinary skill in the art at the time the invention for the 
terminal (U) to be a mobile device in the invention of Giniger et al. because 
more and more business transactions are initiated, negotiated and closed with 
no concern for geography. ([0063]) 
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As per claim 34, Giniger et al. discloses a method of claim 6, however, 
fails to disclose the assigning a local unique identification (LUID) to the terminal 
(U) in order to facilitate matching the terminal with data packets. Rueda et al. 
discloses wherein the untrusted access station (A) assigns an local unique 
identification (LUID) to the terminal (U) in order to facilitate matching the terminal 
with data packets when the untrusted access station (A) is simultaneously 
serving multiple terminals (U). ([0135]-[0136], Figure 14). It would have been 
obvious to a person of ordinary skill in the art at the time the invention to assign a 
local unique identification (LUID) to the terminal (U) in the disclosure of Giniger et 
al. because it allows a server system to send a packet back to the correct client 
when two or more clients have the same IP address. ([0134]) 

Conclusion 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Chirag R. Patel whose telephone number is 
(571)272-7966. The examiner can normally be reached on Monday to Friday 
from 7:30AM to 4:00PM. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Rupal Dharia, can be reached on (571) 272-3880. The 
fax phone number for the organization where this application or proceeding is 
assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
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for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). 




RUPAL DHARIA 

SUPERVISORY PATENT EXAMINER 



